100% Latest & Updated Cisco 300-420 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 660
A retailer adds 70 branches and reused 10.20.0.0/16 at several sites; the MPLS provider cannot distinguish the overlapping prefixes in the enterprise routing table. Which specific risk makes the uncorrected design unacceptable?
- Uncoordinated subnet selection creates overlapping or nonaggregatable IPv6 assignments.
- Tunnel encapsulation overhead and underlay failure can create hard-to-diagnose IPv6 outages.
- Overlapping site prefixes can cause ambiguous reachability and route leaks between branches.
- Unbounded import can consume resources and expose unexpected paths.
Explanation
Correct Answer
C:The supported design response is to allocate nonoverlapping hierarchical IPv4 blocks by region and site, reserving summary boundaries and documenting any unavoidable VRF isolation.
Incorrect Answers
A:That hazard relates to another condition: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. It is not the direct risk evidenced by this case.
B:That hazard arises in a separate case: An organization needs to reach an IPv6 island over a provider network that carries IPv4 only for the next year. It is not the failure mode evidenced here.
D:That hazard arises in a separate case: An edge router receives a full BGP table where the security policy allows only the provider's approved default. It is not the failure mode evidenced here.
Question 661
Two BGP route reflectors share a cluster ID incorrectly with another independent cluster and some legitimate reflected updates disappear. The chosen correction is: Assign and verify cluster identifiers that match the actual reflection topology and check route path attributes. Which additional predeployment check is most relevant?
- Maintain a deterministic subnet-ID allocation ledger before enabling router advertisements.
- Analyze clients, redundant reflector membership and cluster-list attributes before changing IDs.
- Confirm local preference propagation and check business-specific exception prefixes.
- Prefer durable backbone topology repair over making virtual links a permanent substitute for good design.
Explanation
Correct Answer
B:Analyze clients, redundant reflector membership and cluster-list attributes before changing IDs. This protects the intended outcome: Intended client routes propagate without being discarded by false cluster-loop detection.
Incorrect Answers
A:This precaution is appropriate for a different scenario: A provider delegation contains 2001:db8:4200::/48 and the design requires 256 independent /64 LANs across 16 branches. It is less directly relevant to this rollout.
C:That precaution belongs to another scenario: A dual-provider BGP edge must prefer ISP A for outbound traffic, but inbound updates from A have a lower MED than B and engineers assume MED dictates every decision. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A campus OSPF area 0 is split into disconnected islands connected only by another area; route distribution is unstable. It is not the primary safeguard for this rollout.
Question 662
A controller issues RESTCONF PATCH to many routers but treats HTTP 200 from a reverse proxy login page as proof that config was changed. The chosen correction is: Validate authenticated RESTCONF resource responses and follow-up model reads, not merely transport-level success. Which additional predeployment check is most relevant?
- Detect device capability and model revision before applying vendor-specific settings.
- Confirm TLS certificate trust, model revision and supported RPC modes before enabling subscriptions.
- Review the contract's actual management boundary rather than the marketing name.
- Inspect response media type, payload and authorization scopes before accepting writes.
Explanation
Correct Answer
D:Inspect response media type, payload and authorization scopes before accepting writes. This protects the intended outcome: A readback of the exact resource confirms only the intended configuration changed.
Incorrect Answers
A:That precaution belongs to another scenario: A Cisco-only controller needs platform-specific wireless policies that are not represented by the organization's standard OpenConfig model. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A monitoring team tries to exchange gNMI Get and Subscribe messages with a device that only exposes ordinary HTTP REST endpoints. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A customer rents virtual machines from a provider and must patch their operating systems, but procurement classifies the service as SaaS. It is not the primary safeguard for this rollout.
Question 663
A disaster-recovery branch depends on a 5G uplink as backup for wired MPLS, but cellular coverage varies by carrier and power failure. The chosen correction is: Design cellular failover with independent carrier coverage, external antenna and power constraints, plus validated routing. Which additional predeployment check is most relevant?
- Monitor data caps, power and radio signal as part of backup readiness.
- Record SLA impact and safe return criteria before enabling automatic restoration.
- Conduct site-specific signal and application testing rather than assuming headline cellular bandwidth.
- Measure real failover link capacity and decide which applications must be deprioritized.
Explanation
Correct Answer
C:Conduct site-specific signal and application testing rather than assuming headline cellular bandwidth. This protects the intended outcome: During a controlled primary outage, the cellular path carries the approved critical application classes.
Incorrect Answers
A:That precaution belongs to another scenario: Backup 5G is installed at a factory but its data plan and APN firewall rules block VPN establishment after primary fiber failure. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A dual-carrier WAN design changes to backup but automatically switches back on every momentary primary heartbeat recovery. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A branch has broadband backup with no QoS controls and a voice service drops under failover saturation. It is not the primary safeguard for this rollout.
Question 664
An enterprise stretches 200 VLANs end-to-end through many buildings and one STP event triggers campus-wide reconvergence. The chosen correction is: Bound Layer 2 fault domains and use routed access or smaller STP regions where application requirements permit. Which additional predeployment check is most relevant?
- Inventory workloads that truly need Layer 2 adjacency before moving VLAN gateways.
- Test the full supported transit profile rather than relying on basic IP ping success.
- Validate software and licensing support, peer links, and split-brain safeguards before deployment.
- Validate applications requiring nonroutable discovery before enabling targeted relays.
Explanation
Correct Answer
A:Inventory workloads that truly need Layer 2 adjacency before moving VLAN gateways. This protects the intended outcome: An access-switch failure affects only its intended local domain rather than propagating broad STP churn.
Incorrect Answers
B:That precaution belongs to another scenario: A design extends SDA fabric across buildings on a WAN with 1500-byte MTU and assumes local campus performance will continue unchanged. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: Two access switches uplink to a distribution pair; the architecture stretches one port channel across chassis without verifying multi-chassis support. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A campus access layer spans large broadcast domains for print discovery despite an architecture target of small local VLANs. It is not the primary safeguard for this rollout.
Question 665
Network automation can push config to all devices because its management subnet is allowed everywhere despite a read-only reporting requirement. The chosen correction is: Give reporting and change tools separate scoped management identities, roles, and network paths. Which additional predeployment check is most relevant?
- Review both route advertisements and actual access-policy decisions.
- Test device-side RBAC as well as source-network ACLs before release.
- Inventory controllers, NTP, logging, and backup requirements before restricting cross-segment paths.
- Validate platform and routing support, DF election and true application traffic pattern.
Explanation
Correct Answer
B:Test device-side RBAC as well as source-network ACLs before release. This protects the intended outcome: Monitoring reads succeed but change commands from the reporting service are denied.
Incorrect Answers
A:That precaution belongs to another scenario: A campus firewall isolates management VRFs but its shared-services route leaking exports all loopbacks to the guest VRF. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: Two business units share one management VLAN with unrestricted access to each other's routers. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: A many-to-many trading network has multiple multicast senders and a scalable shared-tree forwarding requirement. It is not the primary safeguard for this rollout.
Question 666
An OSPF redistribution boundary introduces the same connected subnet from two ASBRs, resulting in inconsistent egress selection. The chosen correction is: Define controlled redistribution policy, route tags, and appropriate metric type to avoid redundant uncontrolled advertisements. Which additional predeployment check is most relevant?
- Prefer durable backbone topology repair over making virtual links a permanent substitute for good design.
- Compare the aggregation with the live branch prefix inventory and EIGRP summary discard behavior.
- Diagram route origins and inspect tags at each redistribution handoff.
- Model preferred and backup routes with tags and test failure behavior before enabling both ASBRs.
Explanation
Correct Answer
D:Model preferred and backup routes with tags and test failure behavior before enabling both ASBRs. This protects the intended outcome: The prefix exits through the intended ASBR and remains loop-free on failover.
Incorrect Answers
A:That precaution belongs to another scenario: A campus OSPF area 0 is split into disconnected islands connected only by another area; route distribution is unstable. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: Branches summarize their local EIGRP networks at a hub-facing boundary, but a detached subnet is included in the summary. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: Branch A and B redistribute external BGP into OSPF, then advertise resulting routes back into BGP at the opposite edge. It is not the primary safeguard for this rollout.
Question 667
A new fabric edge is reachable over IP, yet Catalyst Center shows its inventory and provisioning state incomplete. The chosen correction is: Confirm supported hardware, management credentials, fabric role, underlay and automation workflow prerequisites. Which additional predeployment check is most relevant?
- Compare the approved software matrix and intended fabric site design before onboarding.
- Validate 802.1X/MAB, identity propagation and policy logs during roaming tests.
- Confirm route leaking and firewall context capacity before moving the border.
- Test the smallest interswitch path and supported MTU settings before fabric activation.
Explanation
Correct Answer
A:Compare the approved software matrix and intended fabric site design before onboarding. This protects the intended outcome: The fabric edge is inventoried, assigned its intended role, and passes overlay endpoint traffic tests.
Incorrect Answers
B:That precaution belongs to another scenario: Users roam between wired fabric edge switches but their identity assignments change with switch port, breaking microsegmentation. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A campus has a fabric border but its external firewall cannot distinguish multiple endpoint VNs leaving the fabric. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: Fabric edge nodes encapsulate packets, but the underlay path MTU is too small for added VXLAN overhead. It is not the primary safeguard for this rollout.
Question 668
A network architect assumes assigning DSCP CS6 to user browsing guarantees faster internet service from a provider that resets all DSCP. The chosen correction is: Negotiate supported carrier class-of-service and align enterprise markings to the actual WAN service contract. Which additional predeployment check is most relevant?
- Coordinate DSCP mapping at the interconnect and verify markings on both sides.
- Validate queue allocation and the actual contracted CIR during saturation tests.
- Verify provider remarking, class limits and contracted service levels before rollout.
- Ensure monitoring and certificate renewal still function inside the isolated management context.
Explanation
Correct Answer
C:Verify provider remarking, class limits and contracted service levels before rollout. This protects the intended outcome: End-to-end packet captures and performance tests show the intended DSCP mapping and queue treatment.
Incorrect Answers
A:That precaution belongs to another scenario: A QoS controller marks all backup data DSCP AF41 while the provider honors it as a premium video class. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A branch uses a shaper on voice and bulk traffic together, and the business assumes shaping guarantees that voice always transmits first. It is not the primary safeguard for this rollout.
D:That precaution belongs to another scenario: Remote branch routers are managed using the same public internet IP address that exposes a user web service. It is not the primary safeguard for this rollout.
Question 669
Two WAN routers advertise the same prefix to separate providers, but the branch returns traffic through a firewall that tracks only one side of the asymmetric flow. The chosen correction is: Design multihoming with explicit path symmetry or state-sharing controls and validate both directions. Which additional predeployment check is most relevant?
- Agree route ownership, policy and acceptance tests with both providers.
- Obtain documented path diversity evidence rather than relying on separate provider names.
- Monitor data caps, power and radio signal as part of backup readiness.
- Test session establishment and failover with real application traffic, not ICMP alone.
Explanation
Correct Answer
D:Test session establishment and failover with real application traffic, not ICMP alone. This protects the intended outcome: Application flows survive permitted egress changes without stateful-firewall drops.
Incorrect Answers
A:That precaution belongs to another scenario: A global business wants to connect its datacenter and branches on two different MPLS L3VPN providers with no accidental route leak between customers. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: A bank contracts two MPLS providers but both fiber tails enter the building through the same conduit. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: Backup 5G is installed at a factory but its data plan and APN firewall rules block VPN establishment after primary fiber failure. It is not the primary safeguard for this rollout.
Question 670
A routed campus uses DHCP snooping on access switches but marks every endpoint port trusted for convenience. The chosen correction is: Trust only legitimate DHCP server/uplink paths and keep edge client ports untrusted. Which additional predeployment check is most relevant?
- Validate cabling and spanning-tree domain boundaries before exempting any port.
- Validate software and licensing support, peer links, and split-brain safeguards before deployment.
- Review platform compatibility and perform a maintenance-window failover test before promising hitless service.
- Confirm trunk and relay paths, IP phones, and bindings before enforcing trust boundaries.
Explanation
Correct Answer
D:Confirm trunk and relay paths, IP phones, and bindings before enforcing trust boundaries. This protects the intended outcome: Rogue DHCP offers from access ports are dropped while authorized client leases succeed.
Incorrect Answers
A:That precaution belongs to another scenario: An access switch's BPDU Guard disables a legitimate downstream bridge, and the network team proposes disabling Guard on every port. It is not the primary safeguard for this rollout.
B:That precaution belongs to another scenario: Two access switches uplink to a distribution pair; the architecture stretches one port channel across chassis without verifying multi-chassis support. It is not the primary safeguard for this rollout.
C:That precaution belongs to another scenario: A remote campus uses two distribution switches and requires nonstop gateway access during a planned supervisor replacement. It is not the primary safeguard for this rollout.
Designing Cisco Enterprise Networks (ENSLD) (300-420) Practice Tests
